Jeff Bezos's phone 'hacked by Saudi crown prince' • Hacker News Board

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#181

Post by angry_octet » Wed, Jan 22, 2020, 3:58 AM UTC

amelius wrote: post #130

eatmyshorts wrote: post #88

Earlier quoted context omitted.

It doesn't matter. The Whatsapp exploit affected both IOS and Android: https://appleinsider.com/articles/19/05/13/whatsapp-vulnerab...

That's interesting. How would that work? Under Android, all apps effectively run inside a Java sandbox, right? So how would the attackers be able to install spyware through Whatsapp?

Since WhatsApp whines incessantly unless you give it various permissions it might have already had the ability to access photos etc.

As well as sending whatever is in its directory or using a local priv escalation.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#182

Post by schalab » Wed, Jan 22, 2020, 3:59 AM UTC

Explanation 1:

Lauren Sanchez(bezos' new girfiend) along with her brother Michael(who is also her agent), leaked the story to force Bezos to divorce his wife and get along with her.

Explanation 2:

The crown prince of Saudi Arabia personally sent a trojan file, downloaded all the data, distributed it through a gossip rag he happens to be friends with, for some kind of revenge/message

I get why Bezos has to go with explanation 2 because explanation 1 would indicate the girl he wants to have sex with or her brother is manipulative. I dont see why the rest of us have to go along with this. Even this anonymous source says he has "high confidence" not anywhere near certainty.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#183

Post by kevml » Wed, Jan 22, 2020, 4:07 AM UTC

eeZah7Ux wrote: post #158

eljimmy wrote: post #91

Earlier quoted context omitted.

That's one hell of a tinfoil-hat theory. How would you even orchestrate that from within a public company with so many developers involved?

It's very easy: hire more developers than security engineers. Vulnerabilities will appear and be discovered by the security analysts in your government. Whey they suspect other countries have the same 0days they'll notify you of it and you fix it.

What if I hire 20 mediocre security engineers and 1 malicious product engineer? This argument can go both ways...

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#184

Post by goalieca » Wed, Jan 22, 2020, 4:12 AM UTC

bb88 wrote: post #27

Apocryphon wrote: post #7

So MBS or someone in Saudi intelligence is somehow behind the leak of the photos to the National Enquirer, and the subsequent divorce of the Bezos?

Where's the Feds on this? I don't find it comforting that attacks happening on the US's free press go unanswered by law enforcement. We should be indicting MBS.

The same feds that let Russia and trump get away with it?

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#185

Post by rossjudson » Wed, Jan 22, 2020, 4:13 AM UTC

therealdrag0 wrote: post #172

henryw wrote: post #4

I'm glad it's fixed now. https://www.facebook.com/security/advisories/cve-2019-11931

This sort of thing blows my mind. Any rough theories on how this sort of thing can happen? How can an app go from parsing metadata to executing foreign code?

It's called C. It's incredibly hard to write secure code in it.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#186

Post by angry_octet » Wed, Jan 22, 2020, 4:14 AM UTC

derefr wrote: post #150

So, anyone want to hazard a guess on why the prince would want the optics of being seen to have been responsible for the hack (as opposed to trying to cover that up by, say, not using his very own account)?

Firstly, he's an idiot. His staff obviously don't brief him on the likely consequences of actions, they just go do it. Because he's a brutal dictator who has disloyal people executed.

Secondly, Saudi's don't have their own advanced cyber capabilities (unlike Iran, UAE, Israel, etc), they rely on buying help. And single use, no interaction, 0day RCEs for recent phones (and we can assume latest iOS or Pixel) are not that available. So they used what they could get their hands on.

It beats me that they couldn't steal the phone of someone else in Bezos's WhatsApp contacts and impersonate them. Maybe Bezos wouldn't have opened the attachment. But overall, I think they are just dumb.

There remains a small possibility that someone hacked the phone of MbS (I mean, everyone has thoughts about doing that) and then pivoted to attacking people in his contacts. But the whole NSO group involvement makes me think it wasn't that.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#187

Post by tootie » Wed, Jan 22, 2020, 4:15 AM UTC

rmsaksida wrote: post #62

Pavel Durov argued that WhatsApp's vulnerabilities are intentionally created as part of surveillance programs with government agencies. [1] If that were true, Bezos's case would be an example of how that approach to security is double-edged. Backdoors can be just as useful to foreign intelligence as they are to whoever pushed for their implementation. [1] https://t.me/s/durov/109

Vulnerabilities are good for intel. Intrusions aren't their concern. If anything it lets them go to Congress and ask for more funding.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#188

Post by clubm8 » Wed, Jan 22, 2020, 4:16 AM UTC

sn41 wrote: post #110

clubm8 wrote: post #15

I wonder how often less high profile folks get hit with stuff like this? On one hand, zero days are rare and expensive. OTOH someone who isn't the CEO of a major company might not notice the malware, or if they do, not know they should forward it to an organization like Citizen Lab.

If you aren't a high profile target, you may not be worthy of being targeted specifically. Of course, as in the Ashley Madison and Equifax cases, you might be compromised along with thousands of others. Zero days are expensive for individuals and small companies, but what happens when state actors are involved?

>If you aren't a high profile target, you may not be worthy of being targeted specifically.

That's what I am questioning.

There are many sysadmins, key executives in tech companies, or open source contributors who may not be "high profile" in the traditional sense but be juicy targets. Arguably there are more useful targets to hack than a CEO who's assuming their every move is being studied and always keeps truly sensitive conversations verbal.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#189

Post by angry_octet » Wed, Jan 22, 2020, 4:18 AM UTC

lawnchair_larry wrote: post #35

caf wrote: post #31

Earlier quoted context omitted.

It seems unlikely it would be MBS himself pressing the button, but a reason why Saudi intelligence might use his personal account is because Bezos would be far more likely to open a video sent from MBS than from some random account.

But the obvious thing to do would be to pick anybody else that Jeff would also talk to and send it from their account instead. Only the most incompetent intelligence agency imaginable would do an op and intentionally attribute it to their own head of state.

Bingo. They really are the most inept.

Re: Jeff Bezos's phone 'hacked by Saudi crown prince'

#190

Post by puranjay » Wed, Jan 22, 2020, 4:24 AM UTC

ljm wrote: post #80

bb88 wrote: post #27

Earlier quoted context omitted.

Where's the Feds on this? I don't find it comforting that attacks happening on the US's free press go unanswered by law enforcement. We should be indicting MBS.

Is that news? It’s well known that MBS is plugging money into tech in order to move away from fossil fuels. You’re not going to get any investment from Saudi Arabia that doesn’t go through him.

Everyone needs to know that every Softbank round is essentially a Saudi Arabia round.